CVE-2023-4000

CVE-2023-4000 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Waiting: One-click countdowns plugin for WordPress, specifically versions up to and including 0.6.2. This flaw stems from inadequate nonce validation in the plugin's AJAX actions. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, enabling them to create or delete countdowns. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with low attack complexity, requiring user interaction, and resulting in low integrity impact (data modification) but no confidentiality or availability impact. Its EPSS score is very low, suggesting a minimal probability of exploitation. Currently, there is no evidence of active exploitation, nor are there any publicly available exploit tools like Metasploit, Nuclei, or ExploitDB entries. Community discussion and media coverage for this CVE are also virtually nonexistent, which is typical for the vast majority of reported vulnerabilities.